The Chopping Block: Black October, Banks Blocking AI Agents, Hyperliquid's Blockchain-Not-Bitcoin Moment, and the Visa-Fireblocks Rumor

“Black October” brought a cluster of severe vulnerabilities across major languages, frameworks, and open-source libraries in roughly 48 hours. The PHP 2 shell involved two flaws that enabled remote code execution on PHP servers, and Cloudflare’s CEO reportedly said millions of people were trying to exploit the PHP vulnerability. The wave also included a less severe Node.js remote-code-execution flaw, a Quick zero-day, GitLab remote code execution, and Linux kernel exploits posted without responsible disclosure.

The effects could persist because older products and companies still run PHP. As a precaution, government services were taken offline or restricted in Finland, the Netherlands, France, and Japan, whose prime minister urged operators to update or shut down web servers. Railway was compromised, exposing DeFi project keys and prompting attempted upgrades; one speaker said the known blast radius was limited. The speakers cautioned that the full extent of exploitation and possible second-order effects remained unknown.

Some observers linked the vulnerability wave to advances in AI models used for cyber offense and defense, including open-weight models, but the speakers did not establish that as the cause. They warned that attacks were becoming faster and more severe, while old code makes recurring vulnerability crises likely. One speaker disputed the idea that AI makes open source untenable: transparent code can help people find and disclose flaws, while closed-source binaries can be reverse-engineered and intrusions may be harder to detect. During Railway-related secret rotation, open-source models were described as the practical option, while access to Mythos and Claude security tools was slower.

Banks are restricting AI agents as users give general-purpose systems bank and credit-card credentials to review spending, investments, and yields. Speakers viewed read-only access as more plausible than agents moving money. JPMorgan CEO Jamie Dimon warned of potentially thousands of rogue agents moving money without users’ approval; Wells Fargo’s CEO also cited unauthorized activity, while calling fears of a deposit exodus overblown. Axios reportedly said Morgan Stanley and Bank of America were blocking agents and Citi was restricting them, with some banks limiting even read-only access. Schwab blocked Muse and reportedly saw unauthorized activity dozens of times a week.

Apollo chief economist Torsten Sluck warned that agents automatically moving cash out of low-yield checking accounts could trigger a bank run; one speaker cited $1.6 trillion in non-interest-bearing deposits that banks can lend and earn a return on. Robert questioned whether banks could verify that agents acted without user requests and suggested such claims might fuel fear. He argued that agents could help consumers move money, close accounts, and avoid uneconomic services, while noting banks took about a decade to accept Plaid for read-only account data. Asim said hosted agents tied to identifiable services are easier to block than locally run agents; speakers disagreed on how widely local agents and workarounds would spread.

Joe Weisenthal said in an Odd Lots newsletter that he may have been wrong about the “blockchain, not Bitcoin” thesis. One speaker saw Hyperliquid as blockchain technology succeeding without Bitcoin being the focus; another questioned whether it proved TradFi adoption, given that Hyperliquid is a perpetual-futures DEX. The proposed opportunity is using perps to create markets for equities, commodities, and pre-IPO assets, but perps and synthetic markets predated Hyperliquid. Speakers said Hyperliquid was making crypto trading relevant beyond a small niche, citing oil trading when the Iran war started. Terry Duffy, meanwhile, was described as a vocal critic of perpetuals and prediction markets who argues for regulatory guardrails.

Axios reported a possible Visa acquisition of Fireblocks for $2.5 billion; follow-up reporting put the potential price at $2 billion to $2.5 billion, and Fireblocks quickly denied the report. Robert said he had no information on whether a deal was happening, but considered it a good acquisition for Visa and a decent outcome for Fireblocks if completed. Speakers pointed to Fireblocks’ revenue, infrastructure, and customers, including stablecoin payment companies, major asset managers, and banks. A sale in that range would clear preferred shares and let most investors make money, though the difference from Fireblocks’ $8 billion 2021 valuation could be difficult for some; speakers also cautioned that January 2022 valuations reflected bubble prices rather than a fair benchmark.